@ordewell/core 0.4.8 → 0.4.10

package/dist/index.mjs

@@ -13,23 +13,30 @@ import {
   resolveTaskMode,
   runnerModesFrom,
   validatePlanModification
-} from "./chunk-YXAIQKVE.mjs";
+} from "./chunk-TUGJXD4G.mjs";
 import {
+  UPDATABLE_FIELDS,
   applyTaskOps,
   canMergeTasks,
   canSetDependencies,
   canSplitTask,
+  clampThinkingEffort,
   classifyOutcome,
+  coerceAssignments,
   dependencyCandidates,
   dependentsOf,
+  effectiveAllowlist,
+  filterModelsForPrompt,
   parseTaskOpsJson,
   summarizeToolCall,
-  textHasTaskOps
-} from "./chunk-4KIWPW4K.mjs";
+  textHasTaskOps,
+  validateTaskEdit
+} from "./chunk-YI4ZDZEE.mjs";
 import {
   PLAN_ENVELOPE_KEY,
   PlanParseError,
   TASK_OPS_ENVELOPE_KEY,
+  TASK_QUERY_ENVELOPE_KEY,
   addTaskToPlan,
   createEmptyPlan,
   createTask,
@@ -49,7 +56,7 @@ import {
   updateTaskInPlan,
   validateModifiedPlan,
   warningsText
-} from "./chunk-SRGQBGI5.mjs";
+} from "./chunk-IO6PEEN6.mjs";
 
 // src/interfaces/IFileSystem.ts
 var GREP_DEFAULT_HEAD_LIMIT = 100;
@@ -118,13 +125,1233 @@ var AUTO_COMMANDS = [
   "jq",
   "yq"
 ];
+var UNIVERSAL_FLAGS = ["--help", "--version"];
+var COUNT_FLAG = /^-\d+$/;
+var FLAG_POLICY = {
+  ls: {
+    cluster: true,
+    booleans: [
+      "-1",
+      "-a",
+      "-A",
+      "-b",
+      "-c",
+      "-C",
+      "-d",
+      "-D",
+      "-f",
+      "-F",
+      "-g",
+      "-G",
+      "-h",
+      "-H",
+      "-i",
+      "-k",
+      "-l",
+      "-L",
+      "-m",
+      "-n",
+      "-N",
+      "-o",
+      "-p",
+      "-q",
+      "-Q",
+      "-r",
+      "-R",
+      "-s",
+      "-S",
+      "-t",
+      "-u",
+      "-U",
+      "-v",
+      "-x",
+      "-X",
+      "-Z",
+      "--all",
+      "--almost-all",
+      "--author",
+      "--escape",
+      "--classify",
+      "--file-type",
+      "--full-time",
+      "--no-group",
+      "--human-readable",
+      "--si",
+      "--dereference-command-line",
+      "--inode",
+      "--kibibytes",
+      "--dereference",
+      "--numeric-uid-gid",
+      "--literal",
+      "--hide-control-chars",
+      "--show-control-chars",
+      "--quote-name",
+      "--reverse",
+      "--recursive",
+      "--size",
+      "--directory",
+      "--group-directories-first",
+      "--context",
+      "--zero"
+    ],
+    values: [
+      "-w",
+      "-I",
+      "-T",
+      "--width",
+      "--ignore",
+      "--hide",
+      "--block-size",
+      "--color",
+      "--format",
+      "--sort",
+      "--time",
+      "--time-style",
+      "--indicator-style",
+      "--quoting-style",
+      "--tabsize"
+    ]
+  },
+  tree: {
+    cluster: true,
+    // `-o` is absent on purpose: it is tree's write-to-a-file flag, which the
+    // redirect check never sees because there is no redirect.
+    booleans: [
+      "-a",
+      "-d",
+      "-f",
+      "-i",
+      "-l",
+      "-x",
+      "-C",
+      "-n",
+      "-p",
+      "-s",
+      "-h",
+      "-u",
+      "-g",
+      "-D",
+      "-t",
+      "-c",
+      "-r",
+      "-F",
+      "-q",
+      "-N",
+      "-Q",
+      "-v",
+      "-J",
+      "-X",
+      "-Z",
+      "--noreport",
+      "--dirsfirst",
+      "--du",
+      "--prune",
+      "--matchdirs",
+      "--inodes",
+      "--device",
+      "--si",
+      "--gitignore",
+      "--ignore-case",
+      "--filesfirst",
+      "--nolinks",
+      "--hintro"
+    ],
+    values: [
+      "-L",
+      "-P",
+      "-I",
+      "-H",
+      "--filelimit",
+      "--timefmt",
+      "--charset",
+      "--sort",
+      "--gitfile",
+      "--info",
+      "--prefix"
+    ]
+  },
+  git: {
+    cluster: true,
+    // Absent on purpose, and each for a reason that was demonstrated rather than
+    // guessed at:
+    //   -c, --config-env  set configuration inline, and several configuration
+    //                     keys name a program to run (`core.pager`, `core.editor`,
+    //                     `diff.external`), so this is an execution flag with one
+    //                     indirection in front of it.
+    //   --exec-path       redirects where git finds its helper programs; a
+    //                     fabricated helper ran during an ordinary remote listing.
+    //   -O, --open-files-in-pager  runs an arbitrary named program over search hits.
+    //   --upload-pack, --receive-pack  name the program run on the other end.
+    //   --textconv, --ext-diff  run filters the repository itself configures.
+    //   --git-dir, --work-tree  repoint git at a tree whose configuration is not
+    //                     the one the developer is looking at.
+    //   -o, --output      write a file. `git ls-files -o` is a legitimate spelling
+    //                     of `--others`, but `git archive -o` writes, and the
+    //                     long spelling stays available for the read.
+    booleans: [
+      "-a",
+      "-b",
+      "-E",
+      "-F",
+      "-h",
+      "-H",
+      "-i",
+      "-I",
+      "-l",
+      "-p",
+      "-P",
+      "-q",
+      "-r",
+      "-R",
+      "-s",
+      "-t",
+      "-u",
+      "-v",
+      "-w",
+      "-z",
+      "--oneline",
+      "--graph",
+      "--stat",
+      "--shortstat",
+      "--numstat",
+      "--dirstat",
+      "--summary",
+      "--name-only",
+      "--name-status",
+      "--raw",
+      "--patch",
+      "--no-patch",
+      "--patch-with-stat",
+      "--cached",
+      "--staged",
+      "--porcelain",
+      "--short",
+      "--long",
+      "--branch",
+      "--show-stash",
+      "--show-current",
+      "--all",
+      "--tags",
+      "--heads",
+      "--remotes",
+      "--list",
+      "--verbose",
+      "--quiet",
+      "--abbrev-ref",
+      "--count",
+      "--reverse",
+      "--first-parent",
+      "--no-merges",
+      "--merges",
+      "--follow",
+      "--full-history",
+      "--simplify-merges",
+      "--sparse",
+      "--dense",
+      "--ancestry-path",
+      "--left-right",
+      "--cherry",
+      "--cherry-pick",
+      "--cherry-mark",
+      "--boundary",
+      "--topo-order",
+      "--date-order",
+      "--author-date-order",
+      "--relative-date",
+      "--parents",
+      "--children",
+      "--timestamp",
+      "--no-walk",
+      "--do-walk",
+      "--decorate",
+      "--no-decorate",
+      "--abbrev-commit",
+      "--no-abbrev-commit",
+      "--abbrev",
+      "--no-abbrev",
+      "--color",
+      "--no-color",
+      "--pretty",
+      "--format",
+      "--expand-tabs",
+      "--no-expand-tabs",
+      "--numbered",
+      "--email",
+      "--no-notes",
+      "--notes",
+      "--show-signature",
+      "--find-renames",
+      "--find-copies",
+      "--find-copies-harder",
+      "--break-rewrites",
+      "--no-renames",
+      "--irreversible-delete",
+      "--full-index",
+      "--binary",
+      "--text",
+      "--check",
+      "--exit-code",
+      "--word-diff",
+      "--function-context",
+      "--ignore-all-space",
+      "--ignore-space-change",
+      "--ignore-space-at-eol",
+      "--ignore-blank-lines",
+      "--ignore-cr-at-eol",
+      "--no-prefix",
+      "--default-prefix",
+      "--no-textconv",
+      "--no-ext-diff",
+      "--submodule",
+      "--ignore-submodules",
+      "--recurse-submodules",
+      "--no-recurse-submodules",
+      "--others",
+      "--deleted",
+      "--modified",
+      "--unmerged",
+      "--stage",
+      "--killed",
+      "--ignored",
+      "--exclude-standard",
+      "--error-unmatch",
+      "--full-name",
+      "--directory",
+      "--no-empty-directory",
+      "--untracked-files",
+      "--no-optional-locks",
+      "--no-pager",
+      "--paginate",
+      "--bare",
+      "--literal-pathspecs",
+      "--glob-pathspecs",
+      "--noglob-pathspecs",
+      "--icase-pathspecs",
+      "--line-number",
+      "--column",
+      "--heading",
+      "--no-index",
+      "--untracked",
+      "--no-recursive",
+      "--name-rev",
+      "--root",
+      "--dirty",
+      "--broken",
+      "--always",
+      "--merged",
+      "--no-merged",
+      "--show-toplevel",
+      "--show-cdup",
+      "--git-common-dir",
+      "--absolute-git-dir",
+      "--is-inside-work-tree",
+      "--is-inside-git-dir",
+      "--is-bare-repository",
+      "--symbolic",
+      "--symbolic-full-name",
+      "--verify",
+      "--short-hash",
+      "--textual",
+      "--batch",
+      "--batch-check",
+      "--batch-all-objects",
+      "--buffer",
+      "--follow-symlinks",
+      "--use-mailmap"
+    ],
+    values: [
+      "-n",
+      "-C",
+      "-B",
+      "-M",
+      "-L",
+      "-S",
+      "-G",
+      "-U",
+      "-e",
+      "-m",
+      "-f",
+      "-g",
+      "-x",
+      "-X",
+      "-W",
+      "--max-count",
+      "--skip",
+      "--since",
+      "--after",
+      "--until",
+      "--before",
+      "--author",
+      "--grep",
+      "--grep-reflog",
+      "--committer",
+      "--date",
+      "--diff-filter",
+      "--unified",
+      "--stat-width",
+      "--stat-name-width",
+      "--stat-count",
+      "--word-diff-regex",
+      "--line-prefix",
+      "--src-prefix",
+      "--dst-prefix",
+      "--pickaxe-regex",
+      "--anchored",
+      "--color-moved",
+      "--color-words",
+      "--inter-hunk-context",
+      "--max-parents",
+      "--min-parents",
+      "--simplify-by-decoration",
+      "--glob",
+      "--exclude",
+      "--sort",
+      "--contains",
+      "--points-at",
+      "--decorate-refs",
+      "--decorate-refs-exclude",
+      "--encoding",
+      "--context",
+      "--max-depth",
+      // `--filters` is absent from this list on purpose: it runs the clean and
+      // smudge filters the repository under research configures, which is the
+      // same execution vector as the configuration flag above with a different
+      // spelling.
+      "--and",
+      "--or",
+      "--not",
+      "--all-match",
+      "--threads",
+      "--path"
+    ],
+    patterns: [COUNT_FLAG]
+  },
+  wc: {
+    cluster: true,
+    booleans: [
+      "-c",
+      "-l",
+      "-m",
+      "-w",
+      "-L",
+      "--bytes",
+      "--chars",
+      "--lines",
+      "--words",
+      "--max-line-length",
+      "--total"
+    ]
+  },
+  du: {
+    cluster: true,
+    booleans: [
+      "-0",
+      "-a",
+      "-b",
+      "-c",
+      "-D",
+      "-h",
+      "-H",
+      "-k",
+      "-l",
+      "-L",
+      "-m",
+      "-P",
+      "-s",
+      "-S",
+      "-x",
+      "--all",
+      "--apparent-size",
+      "--bytes",
+      "--total",
+      "--dereference-args",
+      "--human-readable",
+      "--si",
+      "--inodes",
+      "--count-links",
+      "--dereference",
+      "--no-dereference",
+      "--separate-dirs",
+      "--summarize",
+      "--one-file-system",
+      "--null"
+    ],
+    values: [
+      "-d",
+      "-t",
+      "-B",
+      "-X",
+      "--max-depth",
+      "--threshold",
+      "--block-size",
+      "--exclude",
+      "--exclude-from",
+      "--time",
+      "--time-style",
+      "--files0-from"
+    ]
+  },
+  df: {
+    cluster: true,
+    booleans: [
+      "-a",
+      "-h",
+      "-H",
+      "-i",
+      "-k",
+      "-l",
+      "-m",
+      "-P",
+      "-T",
+      "-v",
+      "--all",
+      "--human-readable",
+      "--si",
+      "--inodes",
+      "--local",
+      "--portability",
+      "--print-type",
+      "--total",
+      "--sync",
+      "--no-sync"
+    ],
+    values: ["-B", "-t", "-x", "--block-size", "--type", "--exclude-type"]
+  },
+  file: {
+    cluster: true,
+    // `-C`/`--compile` is absent: it writes a compiled magic file.
+    booleans: [
+      "-b",
+      "-c",
+      "-h",
+      "-i",
+      "-k",
+      "-L",
+      "-n",
+      "-N",
+      "-p",
+      "-r",
+      "-s",
+      "-S",
+      "-v",
+      "-z",
+      "-0",
+      "--brief",
+      "--mime",
+      "--mime-type",
+      "--mime-encoding",
+      "--dereference",
+      "--no-dereference",
+      "--keep-going",
+      "--no-buffer",
+      "--no-pad",
+      "--raw",
+      "--special-files",
+      "--uncompress",
+      "--print0",
+      "--checking-printout"
+    ],
+    values: [
+      "-e",
+      "-m",
+      "-P",
+      "-F",
+      "--exclude",
+      "--magic-file",
+      "--separator",
+      "--parameter",
+      "--extension",
+      "--files-from"
+    ]
+  },
+  head: {
+    cluster: true,
+    booleans: ["-q", "-v", "-z", "--quiet", "--silent", "--verbose", "--zero-terminated"],
+    values: ["-c", "-n", "--bytes", "--lines"],
+    patterns: [COUNT_FLAG]
+  },
+  tail: {
+    cluster: true,
+    booleans: [
+      "-f",
+      "-F",
+      "-q",
+      "-v",
+      "-z",
+      "--follow",
+      "--retry",
+      "--quiet",
+      "--silent",
+      "--verbose",
+      "--zero-terminated"
+    ],
+    values: [
+      "-c",
+      "-n",
+      "-s",
+      "--bytes",
+      "--lines",
+      "--sleep-interval",
+      "--pid",
+      "--max-unchanged-stats"
+    ],
+    patterns: [COUNT_FLAG]
+  },
+  cat: {
+    cluster: true,
+    booleans: [
+      "-A",
+      "-b",
+      "-e",
+      "-E",
+      "-n",
+      "-s",
+      "-t",
+      "-T",
+      "-u",
+      "-v",
+      "--show-all",
+      "--number-nonblank",
+      "--show-ends",
+      "--number",
+      "--squeeze-blank",
+      "--show-tabs",
+      "--show-nonprinting"
+    ]
+  },
+  sort: {
+    cluster: true,
+    // Absent on purpose: `-o`/`--output` writes a file with no redirect for the
+    // redirect check to see, and `--compress-program` names a program that sort
+    // runs over its own temporary files — a permitted binary as an interpreter.
+    booleans: [
+      "-b",
+      "-c",
+      "-C",
+      "-d",
+      "-f",
+      "-g",
+      "-h",
+      "-i",
+      "-M",
+      "-n",
+      "-r",
+      "-R",
+      "-s",
+      "-u",
+      "-V",
+      "-z",
+      "--ignore-leading-blanks",
+      "--check",
+      "--dictionary-order",
+      "--ignore-case",
+      "--general-numeric-sort",
+      "--human-numeric-sort",
+      "--ignore-nonprinting",
+      "--month-sort",
+      "--numeric-sort",
+      "--random-sort",
+      "--reverse",
+      "--stable",
+      "--unique",
+      "--version-sort",
+      "--zero-terminated",
+      "--debug"
+    ],
+    values: [
+      "-k",
+      "-t",
+      "-S",
+      "-T",
+      "--key",
+      "--field-separator",
+      "--buffer-size",
+      "--temporary-directory",
+      "--random-source",
+      "--batch-size",
+      "--parallel",
+      "--sort"
+    ]
+  },
+  uniq: {
+    cluster: true,
+    booleans: [
+      "-c",
+      "-d",
+      "-D",
+      "-i",
+      "-u",
+      "-z",
+      "--count",
+      "--repeated",
+      "--all-repeated",
+      "--ignore-case",
+      "--unique",
+      "--zero-terminated"
+    ],
+    values: ["-f", "-s", "-w", "--skip-fields", "--skip-chars", "--check-chars", "--group"]
+  },
+  // No flag on either runs a program or writes a file, and the planner's
+  // commonest use of `echo` is a section marker — `echo --- files changed ---`
+  // is three tokens that all begin with a dash and none of them is a flag.
+  echo: { freeform: true },
+  printf: { freeform: true },
+  date: {
+    cluster: true,
+    // `-s`/`--set` is absent: it sets the system clock.
+    booleans: [
+      "-u",
+      "-R",
+      "-I",
+      "--utc",
+      "--universal",
+      "--rfc-email",
+      "--rfc-3339",
+      "--iso-8601",
+      "--debug"
+    ],
+    values: ["-d", "-f", "-r", "--date", "--file", "--reference"]
+  },
+  stat: {
+    cluster: true,
+    booleans: ["-f", "-L", "-t", "--file-system", "--terse", "--dereference"],
+    values: ["-c", "--format", "--printf", "--cached"]
+  },
+  basename: {
+    cluster: true,
+    booleans: ["-a", "-z", "--multiple", "--zero"],
+    values: ["-s", "--suffix"]
+  },
+  dirname: {
+    cluster: true,
+    booleans: ["-z", "--zero"]
+  },
+  realpath: {
+    cluster: true,
+    booleans: [
+      "-e",
+      "-m",
+      "-L",
+      "-P",
+      "-q",
+      "-s",
+      "-z",
+      "--canonicalize-existing",
+      "--canonicalize-missing",
+      "--logical",
+      "--physical",
+      "--quiet",
+      "--strip",
+      "--no-symlinks",
+      "--zero"
+    ],
+    values: ["--relative-to", "--relative-base"]
+  },
+  pwd: { cluster: true, booleans: ["-L", "-P", "--logical", "--physical"] },
+  which: { cluster: true, booleans: ["-a", "-s", "--all"] },
+  type: { cluster: true, booleans: ["-a", "-f", "-p", "-P", "-t"] },
+  uname: {
+    cluster: true,
+    booleans: [
+      "-a",
+      "-i",
+      "-m",
+      "-n",
+      "-o",
+      "-p",
+      "-r",
+      "-s",
+      "-v",
+      "--all",
+      "--kernel-name",
+      "--nodename",
+      "--kernel-release",
+      "--kernel-version",
+      "--machine",
+      "--processor",
+      "--hardware-platform",
+      "--operating-system"
+    ]
+  },
+  whoami: {},
+  cut: {
+    cluster: true,
+    // `--output-delimiter` names a separator string, not a file.
+    booleans: ["-n", "-s", "-z", "--only-delimited", "--complement", "--zero-terminated"],
+    values: [
+      "-b",
+      "-c",
+      "-d",
+      "-f",
+      "--bytes",
+      "--characters",
+      "--delimiter",
+      "--fields",
+      "--output-delimiter"
+    ]
+  },
+  nl: {
+    cluster: true,
+    booleans: ["-p", "--no-renumber"],
+    values: [
+      "-b",
+      "-d",
+      "-f",
+      "-h",
+      "-i",
+      "-l",
+      "-n",
+      "-s",
+      "-v",
+      "-w",
+      "--body-numbering",
+      "--section-delimiter",
+      "--footer-numbering",
+      "--header-numbering",
+      "--join-blank-lines",
+      "--line-increment",
+      "--number-format",
+      "--number-separator",
+      "--starting-line-number",
+      "--number-width"
+    ]
+  },
+  rg: {
+    cluster: true,
+    // `--pre` runs a named preprocessor over every file searched and
+    // `--hostname-bin` runs a named program to resolve the hostname; both are
+    // absent, and `--pre-glob` with them.
+    booleans: [
+      "-a",
+      "-c",
+      "-F",
+      "-h",
+      "-H",
+      "-i",
+      "-I",
+      "-l",
+      "-L",
+      "-n",
+      "-N",
+      "-o",
+      "-p",
+      "-P",
+      "-q",
+      "-s",
+      "-S",
+      "-u",
+      "-uu",
+      "-uuu",
+      "-U",
+      "-v",
+      "-V",
+      "-w",
+      "-x",
+      "-z",
+      "--text",
+      "--count",
+      "--count-matches",
+      "--fixed-strings",
+      "--files",
+      "--files-with-matches",
+      "--files-without-match",
+      "--follow",
+      "--hidden",
+      "--no-hidden",
+      "--ignore-case",
+      "--case-sensitive",
+      "--smart-case",
+      "--invert-match",
+      "--line-number",
+      "--no-line-number",
+      "--with-filename",
+      "--no-filename",
+      "--heading",
+      "--no-heading",
+      "--column",
+      "--no-column",
+      "--byte-offset",
+      "--vimgrep",
+      "--json",
+      "--stats",
+      "--trim",
+      "--pretty",
+      "--passthru",
+      "--word-regexp",
+      "--line-regexp",
+      "--multiline",
+      "--multiline-dotall",
+      "--no-multiline",
+      "--crlf",
+      "--null",
+      "--null-data",
+      "--binary",
+      "--search-zip",
+      "--no-ignore",
+      "--no-ignore-dot",
+      "--no-ignore-exclude",
+      "--no-ignore-files",
+      "--no-ignore-global",
+      "--no-ignore-parent",
+      "--no-ignore-vcs",
+      "--no-ignore-messages",
+      "--no-messages",
+      "--no-require-git",
+      "--require-git",
+      "--one-file-system",
+      "--pcre2",
+      "--no-pcre2",
+      "--auto-hybrid-regex",
+      "--line-buffered",
+      "--block-buffered",
+      "--unicode",
+      "--no-unicode",
+      "--unrestricted",
+      "--type-list",
+      "--debug",
+      "--trace",
+      "--include-zero",
+      "--no-context-separator",
+      "--stop-on-nonmatch",
+      "--quiet",
+      "--no-binary"
+    ],
+    values: [
+      "-A",
+      "-B",
+      "-C",
+      "-d",
+      "-e",
+      "-E",
+      "-f",
+      "-g",
+      "-j",
+      "-m",
+      "-M",
+      "-r",
+      "-t",
+      "-T",
+      "--after-context",
+      "--before-context",
+      "--context",
+      "--context-separator",
+      "--field-context-separator",
+      "--field-match-separator",
+      "--regexp",
+      "--file",
+      "--glob",
+      "--iglob",
+      "--glob-case-insensitive",
+      "--type",
+      "--type-not",
+      "--type-add",
+      "--type-clear",
+      "--max-count",
+      "--max-columns",
+      "--max-depth",
+      "--maxdepth",
+      "--max-filesize",
+      "--replace",
+      "--threads",
+      "--encoding",
+      "--engine",
+      "--sort",
+      "--sortr",
+      "--color",
+      "--colors",
+      "--path-separator",
+      "--ignore-file",
+      "--dfa-size-limit",
+      "--regex-size-limit",
+      "--binary-files",
+      "--max-columns-preview"
+    ]
+  },
+  grep: {
+    cluster: true,
+    // `-o` here is `--only-matching`, which writes nothing. It is the same two
+    // characters as `sort -o`, which writes a file — the reason these sets are
+    // per-binary rather than one shared list.
+    booleans: [
+      "-a",
+      "-b",
+      "-c",
+      "-E",
+      "-F",
+      "-G",
+      "-H",
+      "-h",
+      "-i",
+      "-I",
+      "-l",
+      "-L",
+      "-n",
+      "-o",
+      "-P",
+      "-q",
+      "-r",
+      "-R",
+      "-s",
+      "-T",
+      "-U",
+      "-v",
+      "-w",
+      "-x",
+      "-y",
+      "-z",
+      "-Z",
+      "--extended-regexp",
+      "--fixed-strings",
+      "--basic-regexp",
+      "--perl-regexp",
+      "--ignore-case",
+      "--no-ignore-case",
+      "--invert-match",
+      "--word-regexp",
+      "--line-regexp",
+      "--count",
+      "--files-with-matches",
+      "--files-without-match",
+      "--line-number",
+      "--with-filename",
+      "--no-filename",
+      "--only-matching",
+      "--quiet",
+      "--silent",
+      "--no-messages",
+      "--text",
+      "--binary",
+      "--line-buffered",
+      "--null",
+      "--null-data",
+      "--byte-offset",
+      "--recursive",
+      "--dereference-recursive",
+      "--initial-tab",
+      "--unix-byte-offsets",
+      "--no-group-separator",
+      "--color",
+      "--colour"
+    ],
+    values: [
+      "-A",
+      "-B",
+      "-C",
+      "-d",
+      "-D",
+      "-e",
+      "-f",
+      "-m",
+      "--after-context",
+      "--before-context",
+      "--context",
+      "--regexp",
+      "--file",
+      "--max-count",
+      "--devices",
+      "--directories",
+      "--binary-files",
+      "--include",
+      "--exclude",
+      "--exclude-dir",
+      "--exclude-from",
+      "--label",
+      "--group-separator"
+    ]
+  },
+  find: {
+    // No clustering: find spells its flags as single-dash words, so walking the
+    // characters of `-name` would read it as five short flags. And its arguments
+    // are an expression, so `--` does not end them.
+    expressionArgs: true,
+    // Absent on purpose: `-exec`, `-execdir`, `-ok` and `-okdir` run an inner
+    // command (also caught by the named guard below, which says so more
+    // precisely), `-delete` removes files, and `-fprint`, `-fprint0`, `-fprintf`
+    // and `-fls` are find's write family — the same write as `> file` with no
+    // redirect for the redirect check to see.
+    booleans: [
+      "-H",
+      "-L",
+      "-P",
+      "-a",
+      "-and",
+      "-o",
+      "-or",
+      "-not",
+      "-d",
+      "-depth",
+      "-daystart",
+      "-empty",
+      "-executable",
+      "-false",
+      "-follow",
+      "-help",
+      "--help",
+      "-ignore_readdir_race",
+      "-noignore_readdir_race",
+      "-ls",
+      "-mount",
+      "-nogroup",
+      "-noleaf",
+      "-nouser",
+      "-print",
+      "-print0",
+      "-prune",
+      "-quit",
+      "-readable",
+      "-true",
+      "-version",
+      "-writable",
+      "-xdev"
+    ],
+    values: [
+      "-maxdepth",
+      "-mindepth",
+      "-name",
+      "-iname",
+      "-path",
+      "-ipath",
+      "-wholename",
+      "-iwholename",
+      "-regex",
+      "-iregex",
+      "-lname",
+      "-ilname",
+      "-type",
+      "-xtype",
+      "-size",
+      "-newer",
+      "-anewer",
+      "-cnewer",
+      "-mtime",
+      "-mmin",
+      "-ctime",
+      "-cmin",
+      "-atime",
+      "-amin",
+      "-used",
+      "-uid",
+      "-gid",
+      "-user",
+      "-group",
+      "-perm",
+      "-links",
+      "-inum",
+      "-samefile",
+      "-fstype",
+      "-regextype",
+      "-files0-from",
+      "-printf",
+      "-context",
+      "-D"
+    ],
+    // `find -O2` glues the optimisation level on, and `-newermt`/`-newerat` and
+    // friends spell the two comparison fields into the flag name.
+    patterns: [/^-O\d$/, /^-newer[acmBt][acmBt]$/]
+  },
+  jq: {
+    cluster: true,
+    booleans: [
+      "-a",
+      "-c",
+      "-C",
+      "-e",
+      "-h",
+      "-j",
+      "-M",
+      "-n",
+      "-r",
+      "-R",
+      "-s",
+      "-S",
+      "--ascii-output",
+      "--compact-output",
+      "--color-output",
+      "--monochrome-output",
+      "--exit-status",
+      "--join-output",
+      "--null-input",
+      "--raw-input",
+      "--raw-output",
+      "--raw-output0",
+      "--slurp",
+      "--sort-keys",
+      "--seq",
+      "--stream",
+      "--stream-errors",
+      "--tab",
+      "--unbuffered",
+      "--args",
+      "--jsonargs"
+    ],
+    values: [
+      "-f",
+      "-L",
+      "--arg",
+      "--argjson",
+      "--slurpfile",
+      "--rawfile",
+      "--indent",
+      "--from-file"
+    ]
+  },
+  yq: {
+    cluster: true,
+    // `-i`/`--inplace`/`--in-place` rewrite the file, and `-s`/`--split-exp`
+    // writes one file per document. All absent — and all bare or near-bare
+    // booleans, which is why exempting booleans was not an option.
+    booleans: [
+      "-C",
+      "-e",
+      "-h",
+      "-j",
+      "-M",
+      "-n",
+      "-N",
+      "-P",
+      "-r",
+      "-S",
+      "-v",
+      "-y",
+      "-Y",
+      "--colors",
+      "--no-colors",
+      "--exit-status",
+      "--no-doc",
+      "--null-input",
+      "--prettyPrint",
+      "--raw-output",
+      "--sort-keys",
+      "--tojson",
+      "--yaml-output",
+      "--yaml-roundtrip",
+      "--unwrapScalar",
+      "--header-preprocess",
+      "--no-exit-status",
+      "--verbose",
+      "--xml-strict-mode"
+    ],
+    values: [
+      "-I",
+      "-o",
+      "-p",
+      "-L",
+      "--indent",
+      "--output-format",
+      "--input-format",
+      "--expression",
+      "--width",
+      "--xml-attribute-prefix",
+      "--xml-content-name"
+    ]
+  }
+};
 var GIT_READONLY_SUBCOMMANDS = [
   "log",
   "status",
   "diff",
   "show",
   "ls-files",
-  "ls-remote",
   "ls-tree",
   "branch",
   "tag",
@@ -239,6 +1466,26 @@ var REFUSED_SUBCOMMANDS = {
   az: ["login", "logout"],
   terraform: ["apply", "destroy"]
 };
+var SHELL_KEYWORDS = [
+  "{",
+  "}",
+  "if",
+  "then",
+  "elif",
+  "else",
+  "fi",
+  "for",
+  "while",
+  "until",
+  "do",
+  "done",
+  "case",
+  "esac",
+  "select",
+  "function",
+  "time",
+  "export"
+];
 var INTERPRETERS = [
   "sh",
   "bash",
@@ -682,16 +1929,79 @@ function pathLikeArgs(command, opts = {}) {
     return !a.startsWith("-") && looksLikePath(a) ? [a] : [];
   }));
 }
+function matchFlag(spec, booleans, values, token) {
+  if (token.startsWith("--")) {
+    const eq = token.indexOf("=");
+    const name = eq > 0 ? token.slice(0, eq) : token;
+    if (booleans.has(name)) return "boolean";
+    if (values.has(name)) return eq > 0 ? "boolean" : "value";
+    return void 0;
+  }
+  if (booleans.has(token)) return "boolean";
+  if (values.has(token)) return "value";
+  if (spec.patterns?.some((p) => p.test(token))) return "boolean";
+  if (!spec.cluster) return void 0;
+  for (let i = 1; i < token.length; i++) {
+    const short = `-${token[i]}`;
+    if (booleans.has(short)) continue;
+    if (values.has(short)) return i === token.length - 1 ? "value" : "boolean";
+    return void 0;
+  }
+  return "boolean";
+}
+function takesNextToken(next) {
+  if (next === void 0) return false;
+  return !/^-./.test(next) || /^-\d/.test(next);
+}
+function flagLabel(token) {
+  const eq = token.startsWith("--") ? token.indexOf("=") : -1;
+  return eq > 0 ? token.slice(0, eq) : token;
+}
+function scanFlags(seg) {
+  const spec = FLAG_POLICY[seg.binary];
+  if (!spec || spec.freeform) return void 0;
+  const booleans = /* @__PURE__ */ new Set([...spec.booleans ?? [], ...UNIVERSAL_FLAGS]);
+  const values = new Set(spec.values ?? []);
+  const operands = [];
+  let i = 0;
+  while (i < seg.args.length) {
+    const token = seg.args[i];
+    if (token === "--" && !spec.expressionArgs) {
+      operands.push(...seg.args.slice(i + 1));
+      break;
+    }
+    if (!/^-./.test(token)) {
+      operands.push(token);
+      i++;
+      continue;
+    }
+    const shape = matchFlag(spec, booleans, values, token);
+    if (shape === void 0) return { unknown: flagLabel(token), operands };
+    i += shape === "value" && takesNextToken(seg.args[i + 1]) ? 2 : 1;
+  }
+  return { operands };
+}
+function subcommandOf(seg) {
+  const scan = scanFlags(seg);
+  if (scan) return scan.operands[0];
+  return seg.args.find((a) => !a.startsWith("-"));
+}
+var SCOPE_LEAD_ARGS = 2;
 function scopeFor(seg) {
   if (!MULTIPLEXERS.includes(seg.binary)) return seg.binary;
-  const sub = seg.args.find((a) => !a.startsWith("-"));
-  return sub ? `${seg.binary} ${sub}` : seg.binary;
+  const lead = [];
+  for (const arg of seg.args) {
+    if (arg.startsWith("-")) break;
+    lead.push(arg);
+    if (lead.length === SCOPE_LEAD_ARGS) break;
+  }
+  return [seg.binary, ...lead].join(" ");
 }
 function isAuto(seg) {
   if (!AUTO_COMMANDS.includes(seg.binary)) return false;
   if (seg.expandable) return false;
   if (seg.binary !== "git") return true;
-  const sub = seg.args.find((a) => !a.startsWith("-"));
+  const sub = subcommandOf(seg);
   return sub !== void 0 && GIT_READONLY_SUBCOMMANDS.includes(sub);
 }
 function refusalFor(seg) {
@@ -701,29 +2011,31 @@ function refusalFor(seg) {
   if (seg.binary === "eval" || seg.binary === "exec") {
     return `"${seg.binary}" runs a string as a command, which this classifier cannot inspect. Use the read-only research tools, or describe it as a task.`;
   }
+  if (seg.binary === "source" || seg.binary === ".") {
+    return `"${seg.binary}" runs a file's contents as commands, which this classifier cannot inspect. Use the read-only research tools, or describe it as a task.`;
+  }
+  if (SHELL_KEYWORDS.includes(seg.binary)) {
+    return `"${seg.binary}" is a shell keyword or compound-command opener. This classifier only inspects the command that runs first, and a keyword hides the real one from it. Run the inner command directly, or describe it as a task.`;
+  }
   const subs = REFUSED_SUBCOMMANDS[seg.binary];
   if (subs) {
-    const sub = seg.args.find((a) => !a.startsWith("-"));
+    const sub = subcommandOf(seg);
     if (sub && subs.includes(sub)) {
       return `"${seg.binary} ${sub}" changes state or reaches outward. You are a read-only planner \u2014 put it in the plan and let the runner do it.`;
     }
   }
   if (seg.binary === "git") {
-    const sub = seg.args.find((a) => !a.startsWith("-"));
+    const sub = subcommandOf(seg);
     if (sub === "branch" || sub === "tag") {
       const flag = seg.args.find((a) => ["-D", "-d", "-m", "-M", "--delete", "--move"].includes(a));
       if (flag) {
         return `"git ${sub} ${flag}" mutates refs. You are a read-only planner \u2014 describe the change as a task instead.`;
       }
-    }
-    const execPathFlag = seg.args.find((a) => a === "--exec-path" || a.startsWith("--exec-path="));
-    if (execPathFlag) {
-      return `"git ${execPathFlag}" redirects where git looks for its helper programs, and can make it run an arbitrary one. Use the read-only research tools, or describe the change as a task.`;
-    }
-    if (sub === "grep") {
-      const pagerFlag = seg.args.find((a) => a === "-O" || a === "--open-files-in-pager" || a.startsWith("--open-files-in-pager="));
-      if (pagerFlag) {
-        return `"git grep ${pagerFlag}" opens the results in an arbitrary named program. Use the read-only research tools, or describe the change as a task.`;
+      const listing = seg.args.includes("-l") || seg.args.includes("--list");
+      const scan2 = scanFlags(seg);
+      const target = scan2?.operands[1];
+      if (!listing && target) {
+        return `"git ${sub} ${target}" creates or moves a ref. You are a read-only planner \u2014 describe the change as a task instead.`;
       }
     }
   }
@@ -751,6 +2063,13 @@ function refusalFor(seg) {
   if (seg.assignments.length > 0) {
     return `The environment assignment "${seg.assignments[0]}" decides what "${seg.binary}" actually does, and this classifier cannot judge the value. Re-run the command without the assignment.`;
   }
+  const scan = scanFlags(seg);
+  if (scan?.unknown) {
+    return `"${scan.unknown}" is not a flag this classifier knows to be read-only on "${seg.binary}", and flags on otherwise read-only binaries can run a helper program or write a file. Re-run with read-only flags only, or describe the work as a task.`;
+  }
+  if (seg.binary === "uniq" && scan && scan.operands.length > 1) {
+    return `"uniq" writes to its second file argument ("${scan.operands[1]}"). You are a read-only planner \u2014 pipe the output instead of naming an output file, or describe the write as a task.`;
+  }
   return void 0;
 }
 function withWrapperNote(reason, wrappers) {
@@ -1137,6 +2456,139 @@ It is outside the auto-allowed read-only set (${scope}). Continue with the read-
   }
 };
 
+// src/utils/redactSecrets.ts
+var REDACTION_MARKER = "REDACTED";
+function marker(kind, length) {
+  return `[${REDACTION_MARKER} ${kind}: ${length} chars]`;
+}
+var LINE_PREFIX = String.raw`(?:[ \t]*\d+\||[^\s:]*:\d+:|)[ \t]*`;
+var LINE_PREFIX_ANCHORED = new RegExp("^" + LINE_PREFIX);
+var CREDENTIAL_WORD = String.raw`(?:api[_-]?keys?|secrets?|passwords?|passwd|passphrase|tokens?|access[_-]?keys?|private[_-]?keys?|client[_-]?secrets?|credentials?|auth)(?![a-z])`;
+var NAMED_CREDENTIAL = new RegExp(
+  String.raw`((?:^|[^A-Za-z0-9_])["']?[A-Za-z0-9_.\-]*` + CREDENTIAL_WORD + String.raw`[A-Za-z0-9_.\-]*["']?[ \t]*(?:=>|[:=])[ \t]*)(["'\x60]?)([A-Za-z0-9_\-./+=:~!@#%^&*]{8,})\2`,
+  "gi"
+);
+var DOTENV_CREDENTIAL = new RegExp(
+  String.raw`^(` + LINE_PREFIX + String.raw`(?:export[ \t]+)?[A-Z0-9_]*` + CREDENTIAL_WORD.toUpperCase() + String.raw`[A-Z0-9_]*[ \t]*=[ \t]*)(["'\x60]?)([^\s"'\x60]{3,})\2[ \t]*$`,
+  "gm"
+);
+var PROVIDER_KEY_PATTERNS = [
+  // OpenAI / Anthropic / OpenRouter and the many `sk-` derivatives
+  /(?<![A-Za-z0-9])sk-(?:ant-|proj-|or-v1-|live-|test-)?[A-Za-z0-9_-]{20,}/g,
+  // GitHub personal-access, OAuth, app and refresh tokens
+  /(?<![A-Za-z0-9])(?:gh[pousr]|github_pat)_[A-Za-z0-9_]{22,}/g,
+  // Slack bot / user / app tokens
+  /(?<![A-Za-z0-9])xox[abprse]-[A-Za-z0-9-]{10,}/g,
+  // Stripe secret and restricted keys
+  /(?<![A-Za-z0-9])[sr]k_(?:live|test)_[A-Za-z0-9]{16,}/g,
+  // Google API keys and OAuth access tokens
+  /(?<![A-Za-z0-9])AIza[A-Za-z0-9_-]{30,}/g,
+  /(?<![A-Za-z0-9])ya29\.[A-Za-z0-9_-]{20,}/g,
+  // npm, Hugging Face, Groq, GitLab, DigitalOcean, Shopify
+  /(?<![A-Za-z0-9])(?:npm|hf|gsk|glpat|dop_v1|shpat|shpss)[_-][A-Za-z0-9]{20,}/g,
+  /(?<![A-Za-z0-9])xai-[A-Za-z0-9]{20,}/g,
+  // Three-segment JWTs, whose payload segment is base64 for `{"`
+  /(?<![A-Za-z0-9])eyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g
+];
+var CLOUD_ACCESS_KEY_ID = /(?<![A-Za-z0-9])(?:A3T[A-Z0-9]{2}|AKIA|ASIA|ABIA|ACCA|AGPA|AIDA|AIPA|ANPA|ANVA|AROA)[A-Z0-9]{16}(?![A-Za-z0-9])/g;
+var PEM_BEGIN = /-----BEGIN ((?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?)-----/;
+var PEM_BODY_LINE = /^[A-Za-z0-9+/=:,.\- \t]*$/;
+function redactPrivateKeyBlocks(text) {
+  if (!PEM_BEGIN.test(text)) return text;
+  const out = [];
+  let label = null;
+  let bodyChars = 0;
+  const closeBlock = () => {
+    if (label === null) return;
+    out.push(marker("private key", bodyChars));
+    label = null;
+    bodyChars = 0;
+  };
+  for (const line of text.split("\n")) {
+    if (label === null) {
+      out.push(line);
+      const begun = PEM_BEGIN.exec(line);
+      if (begun) label = begun[1];
+      continue;
+    }
+    const content = line.replace(LINE_PREFIX_ANCHORED, "");
+    if (content.includes(`-----END ${label}-----`)) {
+      closeBlock();
+      out.push(line);
+    } else if (PEM_BODY_LINE.test(content)) {
+      bodyChars += content.trim().length;
+    } else {
+      closeBlock();
+      out.push(line);
+    }
+  }
+  closeBlock();
+  return out.join("\n");
+}
+var NUMERIC = /^[-+]?\d+(?:\.\d+)?$/;
+var IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+var MEMBER_EXPRESSION = /^[A-Za-z_$][A-Za-z0-9_$]*(?:\.[A-Za-z_$][A-Za-z0-9_$]*)+$/;
+var SLUG = /^[a-z]+(?:[-_][a-z]+)+$/;
+var PATHISH = /^(?:\.{0,2}\/|~\/)/;
+var URLISH = /^[a-z][a-z0-9+.-]*:\/\//i;
+var CODE_KEYWORDS = /* @__PURE__ */ new Set([
+  "true",
+  "false",
+  "null",
+  "none",
+  "nil",
+  "undefined",
+  "void",
+  "string",
+  "number",
+  "boolean",
+  "object",
+  "any",
+  "unknown",
+  "bool",
+  "str",
+  "int"
+]);
+var UNAMBIGUOUS_CREDENTIAL_NAME = /(?:password|passwd|passphrase|secret|credentials?|private[_-]?key)/i;
+function looksLikeKeyMaterial(value) {
+  const hasDigit = /\d/.test(value);
+  const hasAlpha = /[A-Za-z]/.test(value);
+  const mixedCase = /[a-z]/.test(value) && /[A-Z]/.test(value);
+  return hasDigit && hasAlpha || mixedCase || value.length >= 24;
+}
+function looksLikeCode(value) {
+  return NUMERIC.test(value) || CODE_KEYWORDS.has(value.toLowerCase()) || MEMBER_EXPRESSION.test(value) || PATHISH.test(value) || URLISH.test(value);
+}
+function trimTrailingPunctuation(value) {
+  const match = /[.:!]+$/.exec(value);
+  if (!match || match.index === 0) return { value, tail: "" };
+  return { value: value.slice(0, match.index), tail: match[0] };
+}
+function redactSecrets(text) {
+  if (!text) return text;
+  let out = redactPrivateKeyBlocks(text);
+  out = out.replace(DOTENV_CREDENTIAL, (full, head, quote, value) => {
+    if (looksLikeCode(value) || value.startsWith("$")) return full;
+    return `${head}${quote}${marker("credential", value.length)}${quote}`;
+  });
+  out = out.replace(NAMED_CREDENTIAL, (full, head, quote, raw) => {
+    const { value, tail } = trimTrailingPunctuation(raw);
+    if (value.length < 8) return full;
+    if (looksLikeCode(value) || value.startsWith("$")) return full;
+    if (UNAMBIGUOUS_CREDENTIAL_NAME.test(head) && /\d/.test(value)) {
+      return `${head}${quote}${marker("credential", value.length)}${quote}${tail}`;
+    }
+    if (IDENTIFIER.test(value) || SLUG.test(value)) return full;
+    if (!UNAMBIGUOUS_CREDENTIAL_NAME.test(head) && !looksLikeKeyMaterial(value)) return full;
+    return `${head}${quote}${marker("credential", value.length)}${quote}${tail}`;
+  });
+  for (const pattern of PROVIDER_KEY_PATTERNS) {
+    out = out.replace(pattern, (hit) => marker("api key", hit.length));
+  }
+  out = out.replace(CLOUD_ACCESS_KEY_ID, (hit) => marker("access key id", hit.length));
+  return out;
+}
+
 // src/services/executeTool.ts
 var GREP_OUTPUT_MODES = ["content", "files", "count"];
 function num(value) {
@@ -1163,6 +2615,10 @@ function grepOptions(args) {
 }
 var STOPPED_TOOL_RESULT = "Stopped by the user \u2014 this call was not executed, and no further tool calls will run this turn.";
 async function executeTool(name, args, fs10, fetcher, signal) {
+  const outcome = await runTool(name, args, fs10, fetcher, signal);
+  return { ...outcome, output: redactSecrets(outcome.output) };
+}
+async function runTool(name, args, fs10, fetcher, signal) {
   if (signal?.aborted) return { success: false, output: STOPPED_TOOL_RESULT, truncated: false };
   switch (name) {
     case "read_file": {
@@ -2317,6 +3773,177 @@ function modesFor(scope, modes) {
   return scoped;
 }
 
+// src/services/TaskQuery.ts
+var TASK_QUERY_FIELDS = [
+  "description",
+  "prompt",
+  "userSteps",
+  "verdict",
+  "outputSummary",
+  "userStoriesCovered"
+];
+function textHasTaskQuery(text) {
+  return text.includes(`"${TASK_QUERY_ENVELOPE_KEY}"`);
+}
+function parseTaskQueryJson(text) {
+  const { matches, fallback } = extractObjectsWithKey(text, TASK_QUERY_ENVELOPE_KEY);
+  const candidates = matches.length > 0 ? [...matches].reverse() : [fallback.json];
+  let lastError = null;
+  for (const json of candidates) {
+    try {
+      return parseTaskQueryObject(json, text);
+    } catch (err) {
+      if (!(err instanceof PlanParseError)) throw err;
+      if (!lastError) lastError = err;
+    }
+  }
+  throw lastError ?? new PlanParseError("No JSON object found in task-query reply", text);
+}
+function parseTaskQueryObject(json, text) {
+  let parsed;
+  try {
+    parsed = JSON.parse(escapeControlCharsInStrings(stripTrailingCommas(json)));
+  } catch (err) {
+    throw new PlanParseError(`Task-query JSON is invalid: ${err instanceof Error ? err.message : String(err)}`, text);
+  }
+  const raw = parsed.taskQuery;
+  const body = Array.isArray(raw) ? { tasks: raw } : raw;
+  if (typeof body !== "object" || body === null) {
+    throw new PlanParseError('"taskQuery" must be an object (or an array of task references)', text);
+  }
+  const { tasks: rawTasks, fields: rawFields, catalog: rawCatalog } = body;
+  const tasks = [];
+  if (rawTasks !== void 0) {
+    if (!Array.isArray(rawTasks)) throw new PlanParseError('"tasks" in a taskQuery must be an array of task references', text);
+    for (const ref of rawTasks) {
+      if (typeof ref !== "string" && typeof ref !== "number") {
+        throw new PlanParseError(`Invalid task reference "${String(ref)}" in taskQuery`, text);
+      }
+      tasks.push(String(ref).trim());
+    }
+  }
+  let fields;
+  if (rawFields !== void 0) {
+    if (!Array.isArray(rawFields)) throw new PlanParseError('"fields" in a taskQuery must be an array of field names', text);
+    fields = [];
+    for (const f of rawFields) {
+      if (typeof f !== "string" || !TASK_QUERY_FIELDS.includes(f)) {
+        throw new PlanParseError(`Unknown taskQuery field "${String(f)}" \u2014 choose from ${TASK_QUERY_FIELDS.join(", ")}`, text);
+      }
+      fields.push(f);
+    }
+  }
+  const catalog = rawCatalog === true;
+  if (tasks.length === 0 && !catalog) {
+    throw new PlanParseError('A taskQuery must name at least one task or set "catalog": true', text);
+  }
+  return { tasks, fields, catalog };
+}
+function taskQuerySignature(query) {
+  return JSON.stringify([query.tasks, query.fields ?? null, query.catalog]);
+}
+var TASK_QUERY_ANSWER_OR_OPS = "You have now read everything you asked for. Do not send another taskQuery this turn: answer the user in prose, or emit the taskOps JSON for the change you came to make.";
+var TASK_QUERY_PROTOCOL = [
+  "READING A TASK BEFORE YOU EDIT IT:",
+  "The plan block you are shown each turn carries only short fields \u2014 it never contains a task's prompt, its user steps, or a completed task's verdict. Never rewrite a field you have not read. To read one, reply with ONLY this JSON object:",
+  `  {"${TASK_QUERY_ENVELOPE_KEY}":{"tasks":["<id or #order>", "..."],"fields":[${TASK_QUERY_FIELDS.map((f) => `"${f}"`).join(", ")}],"catalog":true}}`,
+  '- "tasks": one or more task references. Ask for everything you need in ONE query \u2014 each query costs a round-trip.',
+  '- "fields": optional. Omit it to get every field above.',
+  '- "catalog": optional. Set it to true for the full runner and model catalog \u2014 every model id with its label and thinking-effort variants, and every task mode with its description. It works before any task exists, and may be used on its own.',
+  "Ordewell answers immediately with the detail and changes nothing. Then reply again with your taskOps JSON, or with prose for the user.",
+  "Three queries per user message; after that every answer also tells you to land the turn. Do not ask the same question twice."
+];
+var TASK_QUERY_REMINDER = `- To READ a task in full (prompt, user steps, verdict, output, user stories) or the whole model/mode catalog before editing, reply with ONLY {"${TASK_QUERY_ENVELOPE_KEY}":{"tasks":["<id or #order>"],"catalog":true}} \u2014 it changes nothing, and you then reply again with your ops.`;
+function findTask(tasks, ref) {
+  const byId = tasks.find((t) => t.id === ref);
+  if (byId) return byId;
+  const orderStr = ref.startsWith("#") ? ref.slice(1) : ref;
+  if (/^\d+$/.test(orderStr)) {
+    const byOrder = tasks.filter((t) => t.order === Number(orderStr));
+    if (byOrder.length === 1) return byOrder[0];
+  }
+  return tasks.find((t) => t.title === ref);
+}
+function renderField(task, field) {
+  switch (field) {
+    case "description":
+      return [`description: ${task.description || "(none)"}`];
+    case "prompt":
+      return task.prompt ? ["prompt:", task.prompt] : ["prompt: (none)"];
+    case "userSteps": {
+      const steps = task.userSteps ?? [];
+      if (steps.length === 0) return ["userSteps: (none)"];
+      return ["userSteps:", ...steps.map((s) => `  ${s.order}. [${s.completed ? "x" : " "}] ${s.instruction}`)];
+    }
+    case "verdict": {
+      const v = task.verdict;
+      if (!v) return ["verdict: (none)"];
+      const checks = v.checks.map((c) => `${c.name}=${c.skipped ? "skipped" : c.passed ? "pass" : "fail"}`).join(", ");
+      return [`verdict: ${v.outcome.toUpperCase()} \u2014 ${v.reason}${checks ? ` [${checks}]` : ""}`];
+    }
+    case "outputSummary": {
+      const o = task.outputSummary;
+      if (!o) return ["outputSummary: (none)"];
+      return [`outputSummary: ${o.reviewReason}`, ...o.logTail ? ["log tail:", o.logTail] : []];
+    }
+    case "userStoriesCovered": {
+      const stories = task.userStoriesCovered ?? [];
+      if (stories.length === 0) return ["userStoriesCovered: (none)"];
+      return ["userStoriesCovered:", ...stories.map((s) => `  - ${s}`)];
+    }
+  }
+}
+function renderTask(task, fields) {
+  return [
+    `#${task.order} id=${task.id} "${task.title}" [${task.status}] type:${task.type === "user" ? "MAN" : "AI"}`,
+    ...fields.flatMap((f) => renderField(task, f)),
+    ""
+  ];
+}
+function renderCatalog(catalog) {
+  const lines = [];
+  for (const runner of catalog.runners) {
+    const models = catalog.models[runner] ?? [];
+    lines.push(`${runner} models:`);
+    if (models.length === 0) lines.push("  (none discovered)");
+    for (const m of models) {
+      const variants = m.variants?.length ? ` variants: ${m.variants.map((v) => `${v.id}${v.label && v.label !== v.id ? ` (${v.label})` : ""}`).join(", ")}` : " variants: none";
+      lines.push(`  - ${m.modelId} \u2014 ${m.modelLabel}${variants}`);
+    }
+    const modes = catalog.modes[runner] ?? [];
+    lines.push(`${runner} task modes:`);
+    if (modes.length === 0) lines.push("  (none declared)");
+    const defaultId = resolveDefaultMode(modes, catalog.autonomousDefault);
+    for (const mode of modes) {
+      lines.push(`  - ${mode.id} \u2014 ${mode.label}: ${mode.description}${mode.id === defaultId ? " (default)" : ""}`);
+    }
+  }
+  return lines;
+}
+function renderTaskQueryAnswer(query, tasks, catalog) {
+  const fields = query.fields ?? TASK_QUERY_FIELDS;
+  const blocks = [];
+  if (query.tasks.length > 0) {
+    const body = [];
+    for (const ref of query.tasks) {
+      const task = findTask(tasks, ref);
+      if (!task) {
+        body.push(`${ref}: no task matches this reference in the current plan.`, "");
+        continue;
+      }
+      body.push(...renderTask(task, fields));
+    }
+    blocks.push(["<task_detail>", ...body, "</task_detail>"].join("\n"));
+  }
+  if (query.catalog) {
+    blocks.push(["<runner_catalog>", ...renderCatalog(catalog), "</runner_catalog>"].join("\n"));
+  }
+  blocks.push(
+    "That is everything you asked for. Nothing has changed. Reply now with the taskOps JSON for the edit you intended, or answer the user in prose."
+  );
+  return blocks.join("\n\n");
+}
+
 // src/services/PlanPrompts.ts
 function buildResearchToolsPrompt(subagentsEnabled = false) {
   const lines = [
@@ -2406,7 +4033,8 @@ function researchPhaseBlock(harnessMode) {
   ];
   const toolSpecific = harnessMode ? [
     "- Explore the repository with your own tools until you understand its architecture",
-    "- You are planning, not implementing: do NOT edit, create, or delete any file, and do not run commands that change the workspace"
+    "- You are planning, not implementing: do NOT edit, create, or delete any file, and do not run commands that change the workspace",
+    "- If you delegate exploration to your own agents, WAIT for their results inside this reply. Do NOT launch them in the background or async and end your turn saying you will report back later: your turn ending is what hands the conversation back to the user, and anything you say after it never reaches them."
   ] : [
     "- Use list_dir with depth=2-3 for a tree overview",
     "- Use glob and grep to find relevant source files",
@@ -2571,6 +4199,11 @@ function buildConversationBody(goal, context, modelsJson, runners, modeGuide, mo
     "TASK MODE:",
     modeGuide,
     "",
+    // Shared by both variants on purpose: the read channel is a text envelope
+    // exactly so a harness planner, which Ordewell cannot hand tools to, speaks
+    // the same protocol as an API-backed one (ADR-0009).
+    ...TASK_QUERY_PROTOCOL,
+    "",
     context ? `PROJECT CONTEXT:
 ${context}
 ` : "",
@@ -2878,7 +4511,8 @@ function buildMergePrompt(taskIds, tasks) {
     "The merged task takes the union of their dependencies (excluding the merged tasks themselves) and preserves their user stories.",
     'Set "assignedRunner" and "assignedModel" on the merged task \u2014 use one of the runners and models listed in <available_models> above. Prefer the strongest model if the merged work is complex.',
     'Reply with ONLY a taskOps JSON object using a single "merge" op:',
-    `  {"taskOps":[{"op":"merge","taskIds":[${selected.map((t) => `"${t.id}"`).join(", ")}],"merged":{"title":"...","description":"...","prompt":"...","assignedRunner":"...","assignedModel":{"modelId":"...","modelLabel":"..."}}}]}`
+    `  {"taskOps":[{"op":"merge","taskIds":[${selected.map((t) => `"${t.id}"`).join(", ")}],"merged":{"title":"...","description":"...","prompt":"...","assignedRunner":"...","assignedModel":{"modelId":"...","modelLabel":"..."}}}]}`,
+    `If this merge needs a companion op in the same batch (e.g. an added task that should depend on the merge result), give the merge op a "handle" (any unused name) and reference it from the later op's taskId/dependencies.`
   ].join("\n");
 }
 function buildSplitPrompt(taskId, tasks) {
@@ -2890,7 +4524,8 @@ function buildSplitPrompt(taskId, tasks) {
     "The first part inherits the original task's dependencies. Each later part depends on the previous part. Tasks that depended on the original now depend on the LAST part.",
     'Set "assignedRunner" and "assignedModel" on each part \u2014 use the runners and models listed in <available_models> above. You may assign different models to different parts (e.g. a stronger model for a complex part, a faster one for a simple part).',
     'Reply with ONLY a taskOps JSON object using a single "split" op:',
-    `  {"taskOps":[{"op":"split","taskId":"${task.id}","parts":[{"title":"...","description":"...","prompt":"...","assignedRunner":"...","assignedModel":{"modelId":"...","modelLabel":"..."}},...]}]}`
+    `  {"taskOps":[{"op":"split","taskId":"${task.id}","parts":[{"title":"...","description":"...","prompt":"...","assignedRunner":"...","assignedModel":{"modelId":"...","modelLabel":"..."}},...]}]}`,
+    `If this split needs a companion op in the same batch (e.g. another task that should depend on the last part), give the split op a "handle" (any unused name) \u2014 it names the last part \u2014 and reference it from the later op's taskId/dependencies.`
   ].join("\n");
 }
 
@@ -2917,6 +4552,9 @@ function truncatedPlanReEmitPrompt(historyCompacted) {
 function reEmitTaskOpsPrompt(detail) {
   return `Your task edits could not be applied: ${detail}. Re-emit ONLY a corrected {"${TASK_OPS_ENVELOPE_KEY}":[...]} JSON object \u2014 no prose, no code fences \u2014 or reply in prose if you did not intend to edit tasks.`;
 }
+function reEmitTaskQueryPrompt(detail) {
+  return `Your task-detail request could not be read: ${detail}. Re-emit ONLY a corrected {"${TASK_QUERY_ENVELOPE_KEY}":{"tasks":["<id or #order>"],"fields"?:[...],"catalog"?:true}} JSON object \u2014 no prose, no code fences \u2014 or reply in prose if you did not mean to look anything up.`;
+}
 function taskOpsRejectedPrompt(errors) {
   return `Those task edits were rejected:
 - ${errors.join("\n- ")}
@@ -2943,6 +4581,16 @@ function classifyPlannerReply(text, opts) {
       }
     }
   }
+  if (textHasTaskQuery(text)) {
+    try {
+      return { kind: "task_query", query: parseTaskQueryJson(text) };
+    } catch (err) {
+      if (!(err instanceof PlanParseError)) throw err;
+      if (extractObjectsWithKey(text, TASK_QUERY_ENVELOPE_KEY).matches.length > 0) {
+        return { kind: "broken_task_query", error: err };
+      }
+    }
+  }
   if (text.includes(`"${PLAN_ENVELOPE_KEY}"`)) {
     try {
       return { kind: "plan", tasks: parsePlanJson(text, opts.runners, opts.runnerModes, opts.autonomousDefault) };
@@ -3672,6 +5320,10 @@ ${llmOutput}
       switch (reply.kind) {
         case "task_ops":
           return { kind: "task_ops", ops: reply.ops, text: turn.text, researchLog };
+        // A read is settled by the Session (it owns the plan and the catalog),
+        // so it leaves this loop the same way a plan or an edit does.
+        case "task_query":
+          return { kind: "task_query", query: reply.query, text: turn.text, researchLog };
         case "plan":
           if (ctx.prdEnabled && !ctx.prdCaptured && !ctx.prdNudgeSent && !signal?.aborted) {
             ctx.prdNudgeSent = true;
@@ -3694,6 +5346,13 @@ ${llmOutput}
             continue;
           }
           break;
+        case "broken_task_query":
+          if (jsonRepairAttempts < MAX_JSON_REPAIRS2 && !signal?.aborted) {
+            jsonRepairAttempts++;
+            pending = reEmitTaskQueryPrompt(reply.error.message);
+            continue;
+          }
+          break;
         case "broken_plan":
           if (jsonRepairAttempts < MAX_JSON_REPAIRS2 && !signal?.aborted) {
             jsonRepairAttempts++;
@@ -4498,11 +6157,11 @@ function composeAugmentedPrompt(task, allTasks, opts) {
   if (isHitlTask(task)) {
     blocks.push(renderCheckpointInstruction());
   }
-  const marker = renderCompletionMarker(task);
-  if (blocks.length === 0) return basePrompt + marker;
+  const marker2 = renderCompletionMarker(task);
+  if (blocks.length === 0) return basePrompt + marker2;
   return `${blocks.join("\n\n")}
 
-${basePrompt}${marker}`;
+${basePrompt}${marker2}`;
 }
 
 // src/services/VerdictEngine.ts
@@ -5675,111 +7334,6 @@ ${output.slice(-3e3)}`);
   }
 };
 
-// src/services/ModelAllowlistResolver.ts
-function effectiveAllowlist(allowlist, runner, modelsByRunner) {
-  if (!allowlist || allowlist.length === 0) return void 0;
-  if (!modelsByRunner) return allowlist;
-  const own = new Set((modelsByRunner[runner] ?? []).map((m) => m.modelId));
-  const elsewhere = /* @__PURE__ */ new Set();
-  for (const [other, models] of Object.entries(modelsByRunner)) {
-    if (other === runner) continue;
-    for (const m of models ?? []) elsewhere.add(m.modelId);
-  }
-  const kept = allowlist.filter((id) => own.has(id) || !elsewhere.has(id));
-  return kept.length > 0 ? kept : void 0;
-}
-function filterModelsForPrompt(modelsByRunner, perRunnerAllowlist) {
-  const result = {};
-  for (const [runner, models] of Object.entries(modelsByRunner)) {
-    if (!models) continue;
-    const allowed = effectiveAllowlist(perRunnerAllowlist[runner], runner, modelsByRunner);
-    if (!allowed) {
-      result[runner] = models;
-      continue;
-    }
-    const allowedSet = new Set(allowed);
-    const intersection = models.filter((m) => allowedSet.has(m.modelId));
-    const covered = new Set(intersection.map((m) => m.modelId));
-    const missing = allowed.filter((id) => !covered.has(id)).map((id) => ({ modelId: id, modelLabel: id.split("/").pop() || id, variants: [] }));
-    result[runner] = [...intersection, ...missing];
-  }
-  return result;
-}
-var EFFORT_LADDER = ["none", "minimal", "low", "medium", "high", "xhigh", "max", "ultra"];
-var EFFORT_ALIASES = { disabled: "none", adaptive: "medium" };
-function clampThinkingEffort(effort, variants) {
-  if (!effort) return void 0;
-  if (variants.length === 0) return void 0;
-  const ids = new Set(variants.map((v) => v.id));
-  if (ids.has(effort)) return effort;
-  const canon = EFFORT_ALIASES[effort] ?? effort;
-  if (ids.has(canon)) return canon;
-  const idx = EFFORT_LADDER.indexOf(canon);
-  if (idx < 0) return void 0;
-  for (let d = 1; d < EFFORT_LADDER.length; d++) {
-    const lower = EFFORT_LADDER[idx - d];
-    if (lower && ids.has(lower)) return lower;
-    const higher = EFFORT_LADDER[idx + d];
-    if (higher && ids.has(higher)) return higher;
-  }
-  return void 0;
-}
-function coerceAssignments(tasks, perRunnerAllowlist, allowedRunners, modelsByRunner) {
-  const clampVariant = (task) => {
-    if (!task.assignedModel || !modelsByRunner) return task;
-    const model = modelsByRunner[task.assignedRunner]?.find(
-      (m) => m.modelId === task.assignedModel.modelId
-    );
-    if (!model) return task;
-    const clamped = clampThinkingEffort(task.assignedModel.thinkingEffort, model.variants);
-    return {
-      ...task,
-      assignedModel: {
-        ...task.assignedModel,
-        thinkingEffort: clamped,
-        availableVariants: model.variants.map((v) => v.id)
-      }
-    };
-  };
-  const allowedFor = (runner) => effectiveAllowlist(perRunnerAllowlist[runner], runner, modelsByRunner);
-  const assignmentFor = (runner, modelId) => {
-    const known = modelsByRunner?.[runner]?.find((m) => m.modelId === modelId);
-    return {
-      modelId,
-      modelLabel: known?.modelLabel ?? modelId,
-      thinkingEffort: void 0,
-      ...known ? { availableVariants: known.variants.map((v) => v.id) } : {}
-    };
-  };
-  return tasks.map((task) => {
-    if (task.type === "user") return task;
-    if (allowedRunners && !allowedRunners.includes(task.assignedRunner)) {
-      const fallbackRunner = allowedRunners[0];
-      const fallbackModels = allowedFor(fallbackRunner);
-      const fallbackModel = fallbackModels?.length ? assignmentFor(fallbackRunner, fallbackModels[0]) : modelsByRunner?.[fallbackRunner]?.[0] ? assignmentFor(fallbackRunner, modelsByRunner[fallbackRunner][0].modelId) : task.assignedModel;
-      return clampVariant({
-        ...task,
-        assignedRunner: fallbackRunner,
-        assignedModel: fallbackModel
-      });
-    }
-    const allowlist = allowedFor(task.assignedRunner);
-    if (!task.assignedModel) {
-      if (allowlist && allowlist.length > 0) {
-        return clampVariant({ ...task, assignedModel: assignmentFor(task.assignedRunner, allowlist[0]) });
-      }
-      const discovered = modelsByRunner?.[task.assignedRunner]?.[0];
-      if (discovered) {
-        return clampVariant({ ...task, assignedModel: assignmentFor(task.assignedRunner, discovered.modelId) });
-      }
-      return task;
-    }
-    if (!allowlist || allowlist.length === 0) return clampVariant(task);
-    if (allowlist.includes(task.assignedModel.modelId)) return clampVariant(task);
-    return { ...task, assignedModel: assignmentFor(task.assignedRunner, allowlist[0]) };
-  });
-}
-
 // src/services/Planner.ts
 function plannerModesWith(req) {
   const modes = req.modes ?? DEFAULT_PLANNER_MODES;
@@ -7449,7 +9003,7 @@ function assertWorkspaceIsProject(workspace, deps = {}) {
     throw new WorkspaceNotAProjectError(workspace);
   }
   const hasMarker = [...PROJECT_MARKER_DIRS, ...PROJECT_MARKER_FILES].some(
-    (marker) => exists(path9.join(resolved, marker))
+    (marker2) => exists(path9.join(resolved, marker2))
   );
   if (!hasMarker) throw new WorkspaceNotAProjectError(workspace);
 }
@@ -7491,12 +9045,19 @@ var StdioAgentAdapter = class {
   /** Set for the duration of a turn. Outside one, events are buffered rather than dropped. */
   turnEmit = null;
   /**
-   * Events the agent produced between turns — in practice the startup warnings
-   * that arrive during the handshake. Dropping them hid the one diagnostic
-   * that explains a planner which cannot read the workspace, so they are held
-   * until a turn exists to show them in.
+   * Events the agent produced before its first turn — in practice the startup
+   * warnings that arrive during the handshake. Dropping them hid the one
+   * diagnostic that explains a planner which cannot read the workspace, so they
+   * are held until a turn exists to show them in.
+   *
+   * Only before the *first* turn. Once one has run, anything arriving outside a
+   * turn is that closed turn's straggling work — a backgrounded subagent
+   * finishing, a late read — and replaying it into the next turn presents it as
+   * research done for the user's new message.
    */
   betweenTurns = [];
+  /** Set once a turn has ended: after that, out-of-turn events are stale, not startup. */
+  hadTurn = false;
   disposed = false;
   /** Resolves when the process ends, so a handshake can lose the race instead of waiting out its timeout. */
   processEnded;
@@ -7531,7 +9092,7 @@ var StdioAgentAdapter = class {
     this.process.stdout?.on("data", (chunk) => {
       this.stdout.push(chunk.toString(), (line) => this.handleLine(line, (event) => {
         if (this.turnEmit) this.turnEmit(event);
-        else if (!TURN_SCOPED_EVENTS.has(event.type) && this.betweenTurns.length < BETWEEN_TURN_EVENT_CAP) {
+        else if (!this.hadTurn && !TURN_SCOPED_EVENTS.has(event.type) && this.betweenTurns.length < BETWEEN_TURN_EVENT_CAP) {
           this.betweenTurns.push(event);
         }
       }));
@@ -7563,6 +9124,7 @@ ${err.message}`).slice(-STDERR_TAIL_CHARS);
         if (settled) return;
         settled = true;
         this.turnEmit = null;
+        this.hadTurn = true;
         signal?.removeEventListener("abort", onAbort);
         this.process?.removeListener("exit", onExit);
         this.process?.removeListener("error", onExit);
@@ -7641,6 +9203,7 @@ ${tail}` : ""}`;
 
 // src/services/harness/ClaudeCodeAdapter.ts
 var DISALLOWED_TOOLS = ["Edit", "Write", "MultiEdit", "NotebookEdit", "KillShell"];
+var ASYNC_LAUNCH_MARKER = "Async agent launched successfully";
 function flattenContent(content) {
   if (typeof content === "string") return content;
   if (Array.isArray(content)) {
@@ -7650,6 +9213,8 @@ function flattenContent(content) {
 }
 var ClaudeCodeAdapter = class extends StdioAgentAdapter {
   agentId = "claude-code";
+  /** Whether this turn has already emitted reply text — see {@link handleLine}. */
+  turnHasText = false;
   spawnSpec(opts) {
     const args = [
       "-p",
@@ -7674,6 +9239,7 @@ var ClaudeCodeAdapter = class extends StdioAgentAdapter {
     return { command: "claude", args };
   }
   turnPayload(message) {
+    this.turnHasText = false;
     return `${JSON.stringify({
       type: "user",
       message: { role: "user", content: [{ type: "text", text: message }] }
@@ -7684,6 +9250,7 @@ var ClaudeCodeAdapter = class extends StdioAgentAdapter {
     const msg = StdioAgentAdapter.parse(line);
     if (!msg) return;
     if (msg.session_id) this.sessionId = msg.session_id;
+    if (msg.parent_tool_use_id) return;
     switch (msg.type) {
       // The control channel: Claude asks whether a tool may run when its mode
       // cannot decide alone. A read-only planner answers "deny", every time —
@@ -7708,8 +9275,12 @@ var ClaudeCodeAdapter = class extends StdioAgentAdapter {
       }
       case "assistant":
         for (const block of Array.isArray(msg.message?.content) ? msg.message.content : []) {
-          if (block.type === "text" && block.text) emit({ type: "assistant_text", text: block.text });
-          else if (block.type === "thinking" && block.thinking) emit({ type: "thinking", text: block.thinking });
+          if (block.type === "text" && block.text) {
+            emit({ type: "assistant_text", text: this.turnHasText ? `
+
+${block.text}` : block.text });
+            this.turnHasText = true;
+          } else if (block.type === "thinking" && block.thinking) emit({ type: "thinking", text: block.thinking });
           else if (block.type === "tool_use" && block.name) {
             emit({ type: "tool_call", id: block.id ?? block.name, name: block.name, args: block.input ?? {} });
           }
@@ -7718,11 +9289,15 @@ var ClaudeCodeAdapter = class extends StdioAgentAdapter {
       case "user":
         for (const block of Array.isArray(msg.message?.content) ? msg.message.content : []) {
           if (block.type !== "tool_result") continue;
+          const output = flattenContent(block.content);
+          if (output.includes(ASYNC_LAUNCH_MARKER)) {
+            emit({ type: "background_agent", id: block.tool_use_id ?? "" });
+          }
           emit({
             type: "tool_result",
             id: block.tool_use_id ?? "",
             name: "",
-            output: flattenContent(block.content),
+            output,
             success: block.is_error !== true
           });
         }
@@ -8142,6 +9717,8 @@ var OpenCodeAdapter = class {
   exited = false;
   disposed = false;
   opts = null;
+  /** Whether this turn has already emitted reply text — see {@link emitPart}. */
+  turnHasText = false;
   async start(opts) {
     this.opts = opts;
     assertWorkspaceExists(opts.cwd, { isDirectory: this.deps.isDirectory });
@@ -8209,6 +9786,7 @@ ${this.stderrTail.trim()}` : ""}`);
       return;
     }
     const seen = /* @__PURE__ */ new Set();
+    this.turnHasText = false;
     const streamAbort = new AbortController();
     let connected = () => {
     };
@@ -8277,7 +9855,10 @@ ${this.stderrTail.trim()}` : ""}`);
     if (part.type === "text" && part.text) {
       if (seen.has(`text:${id}`)) return;
       seen.add(`text:${id}`);
-      onEvent({ type: "assistant_text", text: part.text });
+      onEvent({ type: "assistant_text", text: this.turnHasText ? `
+
+${part.text}` : part.text });
+      this.turnHasText = true;
       return;
     }
     if (part.type === "reasoning" && part.text) {
@@ -8444,6 +10025,7 @@ function normalizeAgentArgs(tool, args) {
 
 // src/services/harness/CliAgentAiService.ts
 var MAX_JSON_REPAIRS = 2;
+var MAX_AGENT_WAITS = 2;
 var LOG_MAX_CHARS = 1e4;
 function defaultAdapter(runner, deps) {
   switch (runner) {
@@ -8584,13 +10166,16 @@ var CliAgentAiService = class {
     let pending = message;
     let emptyNudgeSent = false;
     let jsonRepairAttempts = 0;
+    let agentWaits = 0;
+    const carried = [];
+    const replyText = (text) => [...carried, text].filter((part) => part.trim()).join("\n\n");
     try {
       for (; ; ) {
         const turn = await this.runTurn(pending, onProgress, combined);
         researchLog.push(...turn.researchLog);
         if (turn.aborted || combined?.aborted) {
           onProgress({ type: "interrupted" });
-          return { kind: "message", text: turn.text, researchLog };
+          return { kind: "message", text: replyText(turn.text), researchLog };
         }
         if (turn.error) {
           return { kind: "message", text: turn.error, researchLog };
@@ -8608,6 +10193,18 @@ var CliAgentAiService = class {
             researchLog
           };
         }
+        if (turn.backgroundAgents > 0 && agentWaits < MAX_AGENT_WAITS && !combined?.aborted) {
+          agentWaits++;
+          carried.push(turn.text);
+          pending = [
+            `You ended your turn with ${turn.backgroundAgents} subagent(s) still running in the background.`,
+            "Ordewell hands the conversation back to the user when your turn ends, so anything you say after it never reaches them \u2014",
+            "the results you promised to report would be lost.",
+            "Wait for those agents to finish NOW, in this reply, and do not end your turn until you have their results.",
+            "Then give the user your synthesis. In future replies, await your agents inside the turn rather than backgrounding them."
+          ].join(" ");
+          continue;
+        }
         if (extractPrdBlock(turn.text)) conversation.prdCaptured = true;
         const reply = classifyPlannerReply(turn.text, {
           runners: conversation.runners,
@@ -8616,7 +10213,11 @@ var CliAgentAiService = class {
         });
         switch (reply.kind) {
           case "task_ops":
-            return { kind: "task_ops", ops: reply.ops, text: turn.text, researchLog };
+            return { kind: "task_ops", ops: reply.ops, text: replyText(turn.text), researchLog };
+          // The read channel is a text envelope precisely so it reaches here
+          // too: a harness planner has no Ordewell tool loop to call into.
+          case "task_query":
+            return { kind: "task_query", query: reply.query, text: replyText(turn.text), researchLog };
           case "plan":
             if (conversation.prdEnabled && !conversation.prdCaptured && !conversation.prdNudgeSent && !combined?.aborted) {
               conversation.prdNudgeSent = true;
@@ -8629,7 +10230,7 @@ var CliAgentAiService = class {
               continue;
             }
             this.conversation = null;
-            return { kind: "plan", tasks: reply.tasks, text: turn.text, researchLog };
+            return { kind: "plan", tasks: reply.tasks, text: replyText(turn.text), researchLog };
           case "broken_task_ops":
             if (jsonRepairAttempts < MAX_JSON_REPAIRS && !combined?.aborted) {
               jsonRepairAttempts++;
@@ -8637,6 +10238,13 @@ var CliAgentAiService = class {
               continue;
             }
             break;
+          case "broken_task_query":
+            if (jsonRepairAttempts < MAX_JSON_REPAIRS && !combined?.aborted) {
+              jsonRepairAttempts++;
+              pending = reEmitTaskQueryPrompt(reply.error.message);
+              continue;
+            }
+            break;
           case "broken_plan":
             if (jsonRepairAttempts < MAX_JSON_REPAIRS && !combined?.aborted) {
               jsonRepairAttempts++;
@@ -8647,7 +10255,7 @@ var CliAgentAiService = class {
           case "prose":
             break;
         }
-        return { kind: "message", text: turn.text, researchLog };
+        return { kind: "message", text: replyText(turn.text), researchLog };
       }
     } finally {
       this.activeAbort = null;
@@ -8667,9 +10275,11 @@ var CliAgentAiService = class {
     let text = "";
     let error;
     let stepIndex = 0;
+    let backgroundAgents = 0;
     const truncate = (value) => value.length > LOG_MAX_CHARS ? `${value.slice(0, LOG_MAX_CHARS)}
 [... truncated, total ${value.length} chars]` : value;
-    const settle = (id, output, success, outcome) => {
+    const settle = (id, rawOutput, success, outcome) => {
+      const output = redactSecrets(rawOutput);
       const call = pendingCalls.get(id);
       pendingCalls.delete(id);
       const step = {
@@ -8705,6 +10315,9 @@ var CliAgentAiService = class {
         case "tool_result":
           settle(event.id, event.output, event.success, event.success ? "success" : "failure");
           return;
+        case "background_agent":
+          backgroundAgents++;
+          return;
         case "permission_request": {
           const mapped = mapAgentTool(event.name);
           const args = JSON.stringify({ detail: event.detail });
@@ -8735,7 +10348,7 @@ var CliAgentAiService = class {
       adapter.dispose();
       this.adapter = null;
     }
-    return { text, researchLog, error, aborted: signal?.aborted };
+    return { text, researchLog, error, aborted: signal?.aborted, backgroundAgents };
   }
   // --- Process lifecycle ---
   async startAdapter(opts) {
@@ -9200,6 +10813,16 @@ function ensureDir(dir) {
 function getStateDir(baseDir) {
   return path10.join(baseDir ?? process.cwd(), STATE_DIR);
 }
+var IGNORE_FILE = ".gitignore";
+function ensureStateDirIgnored(baseDir) {
+  const dir = getStateDir(baseDir);
+  ensureDir(dir);
+  try {
+    fs4.writeFileSync(path10.join(dir, IGNORE_FILE), "*\n", { flag: "wx" });
+  } catch (err) {
+    if (err.code !== "EEXIST") throw err;
+  }
+}
 
 // src/utils/sessionId.ts
 import { randomBytes } from "crypto";
@@ -9229,6 +10852,7 @@ function sessionFilename(session) {
 function saveSession(plan, goal, baseDir, id) {
   const sessionsDir = getSessionsDir(baseDir);
   ensureDir(sessionsDir);
+  ensureStateDirIgnored(baseDir);
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const meta = {
     id: id || mintSessionId(),
@@ -9331,6 +10955,12 @@ function deleteSession(sessionId, baseDir, logger = defaultLogger) {
 }
 
 // src/services/createSession.ts
+var CATALOG_MODEL_CAP = 100;
+var MAX_TASK_QUERIES = 3;
+var MAX_TASK_QUERIES_HARD = 6;
+function freshReadBudget() {
+  return { answered: 0, seen: /* @__PURE__ */ new Set() };
+}
 var PlanEditError = class extends Error {
   constructor(message) {
     super(message);
@@ -9567,6 +11197,21 @@ var Session = class {
   runnerModesFor(runners) {
     return runnerModesFrom(this.registry, runners);
   }
+  /**
+   * The catalog a model/task-mode edit is checked against — the same
+   * discovered models and manifest modes the per-turn catalog block shows the
+   * planner, so a refusal here can never name something invalid that the
+   * planner was never told about. `modelsCache` is read live, not filtered by
+   * the allowlist here — {@link checkModelAndModeValidity} narrows by
+   * allowlist itself, the same way `coerceAssignments` does.
+   */
+  editCatalog() {
+    return {
+      modelsByRunner: this.modelsCache,
+      runnerModes: this.runnerModesFor(this.plan?.runners ?? []),
+      perRunnerAllowlist: this.settingsFn().modelAllowlist ?? this.currentAllowlist
+    };
+  }
   get planState() {
     return this.plan;
   }
@@ -9746,10 +11391,12 @@ var Session = class {
   async continueConversation(userMessage, options) {
     if (!this.plan) throw new Error("No planning conversation to continue");
     const priorHistory = this.plan.conversationHistory ?? [];
+    const priorResearchLog = this.plan.researchLog ?? [];
     const now = (/* @__PURE__ */ new Date()).toISOString();
     this.appendTranscript("user", userMessage, now);
+    const historyAfterOwnAppend = this.plan.conversationHistory;
     this.plan.researchLog = [...this.plan.researchLog ?? [], { id: `up-${Date.now()}`, type: "user_prompt", content: userMessage, timestamp: now }];
-    const contextBlock = this.planContextBlock();
+    const contextBlock = [this.catalogBlock(), this.planContextBlock()].filter(Boolean).join("\n\n");
     const outgoing = contextBlock ? `${contextBlock}
 
 ${userMessage}` : userMessage;
@@ -9762,6 +11409,8 @@ ${userMessage}` : userMessage;
         (p) => this.translateProgress(p),
         options?.signal
       ) : await this.resumeConversation(outgoing, priorHistory, options);
+      const reads = freshReadBudget();
+      turn = await this.drainTaskQueries(turn, reads, options);
       if ((turn.kind === "task_ops" || turn.kind === "plan") && this.hasLiveWork) {
         this.queueMessage(userMessage);
         this.plan.queuedMessages = this.getQueuedMessages();
@@ -9771,11 +11420,74 @@ ${userMessage}` : userMessage;
           researchLog: turn.researchLog
         };
       }
-      return await this.settleTurn(turn, options);
+      return await this.settleTurn(turn, options, reads);
+    } catch (err) {
+      if (this.plan && this.plan.conversationHistory === historyAfterOwnAppend) {
+        this.plan.conversationHistory = priorHistory;
+        this.plan.researchLog = priorResearchLog;
+      }
+      throw err;
     } finally {
       releaseAbort();
     }
   }
+  /**
+   * Answer every read the planner emits until it says something else.
+   *
+   * The channel is a text envelope rather than a registered tool because the
+   * protocol has to be identical on both planner backends (ADR-0009): Ordewell
+   * owns a tool loop only in the API case, and a harness planner running as a
+   * coding-agent subprocess can only be reached this way.
+   *
+   * Draining here — outside {@link repairLoop} — is what keeps reads free of
+   * the repair budget. A planner that looks a task up and *then* fumbles its
+   * ops JSON still gets its two corrective retries; charging it for the read
+   * would cost it the chance to fix the edit.
+   */
+  async drainTaskQueries(turn, reads, options) {
+    const carried = [];
+    let current = turn;
+    while (current.kind === "task_query") {
+      carried.push(...current.researchLog);
+      if (reads.answered >= MAX_TASK_QUERIES_HARD || !this.aiService.hasActiveConversation() || options?.signal?.aborted) {
+        return {
+          kind: "message",
+          text: "The planner kept asking to read tasks instead of answering. Nothing was changed \u2014 ask again, or be more specific about the edit you want.",
+          researchLog: carried
+        };
+      }
+      const signature = taskQuerySignature(current.query);
+      const insist = reads.seen.has(signature) || reads.answered >= MAX_TASK_QUERIES;
+      reads.seen.add(signature);
+      reads.answered++;
+      const answer = this.taskQueryAnswer(current.query);
+      current = await this.aiService.continueConversation(
+        insist ? `${answer}
+
+${TASK_QUERY_ANSWER_OR_OPS}` : answer,
+        (p) => this.translateProgress(p),
+        options?.signal
+      );
+    }
+    return carried.length > 0 ? { ...current, researchLog: [...carried, ...current.researchLog] } : current;
+  }
+  /**
+   * Render one read out of live state. Never persisted to the transcript: the
+   * detail is context for the planner's next reply, and re-sending it on every
+   * later turn is exactly the cost this channel exists to avoid.
+   */
+  taskQueryAnswer(query) {
+    const runners = this.plan?.runners ?? [];
+    const allowlist = this.settingsFn().modelAllowlist ?? this.currentAllowlist;
+    return renderTaskQueryAnswer(query, this.store.planTasks, {
+      runners,
+      // Allowlist-filtered like the always-on block: a read must not offer a
+      // model the planner is forbidden to assign.
+      models: filterModelsForPrompt(this.modelsCache, allowlist),
+      modes: this.runnerModesFor(runners),
+      autonomousDefault: this.config.autonomousMode
+    });
+  }
   /**
    * Drive a planner turn to a persisted, broadcast outcome. Task edits apply
    * atomically; validation failures are fed back to the model for up to 2
@@ -9783,7 +11495,7 @@ ${userMessage}` : userMessage;
    * first turn (startPlanning) and every later turn route through here — one
    * path, not two.
    */
-  async settleTurn(turn, options) {
+  async settleTurn(turn, options, reads = freshReadBudget()) {
     const invalidOps = (errors, researchLog) => ({
       turn: {
         kind: "message",
@@ -9795,11 +11507,15 @@ The plan is unchanged. Rephrase the request, or adjust the tasks manually.`,
       }
     });
     const settled = await repairLoop({
-      first: () => turn,
-      resend: (corrective) => this.aiService.continueConversation(
-        corrective,
-        (p) => this.translateProgress(p),
-        options?.signal
+      first: () => this.drainTaskQueries(turn, reads, options),
+      resend: async (corrective) => this.drainTaskQueries(
+        await this.aiService.continueConversation(
+          corrective,
+          (p) => this.translateProgress(p),
+          options?.signal
+        ),
+        reads,
+        options
       ),
       interpret: (t) => {
         if (t.kind !== "task_ops") return { done: { turn: t } };
@@ -9819,6 +11535,52 @@ The plan is unchanged. Rephrase the request, or adjust the tasks manually.`,
     }
     return this.applyConversationTurn(settled.turn);
   }
+  /**
+   * The catalog the planner may actually draw from — model ids and task-mode
+   * ids, per selected runner — emitted on EVERY turn, before any plan exists
+   * or after. The system prompt shows this once at conversation start; a long
+   * grill-me interview or PRD negotiation outlives that single showing and the
+   * planner starts misquoting it, so this re-states it per turn instead.
+   *
+   * Built from the allowlist-filtered view (`filterModelsForPrompt`), the same
+   * one the system prompt used — a restricted allowlist stays a hard bound on
+   * every turn, not just the first. `this.modelsCache` itself is never
+   * filtered: `coerceAssignments` needs the full discovered catalog alongside
+   * the allowlist to resolve labels and clamp effort to real variants.
+   *
+   * Reads `this.plan.runners` live, so a runner admitted mid-session by a
+   * retarget (`admitRunner`) is filtered and shown like every other — there is
+   * no separate "originally selected" list to fall stale.
+   */
+  catalogBlock() {
+    if (!this.plan) return null;
+    const allowlist = this.settingsFn().modelAllowlist ?? this.currentAllowlist;
+    const filteredModels = filterModelsForPrompt(this.modelsCache, allowlist);
+    const runnerModes = this.runnerModesFor(this.plan.runners);
+    const autonomousDefault = this.config.autonomousMode;
+    const modelLines = this.plan.runners.map((runner) => {
+      const models = filteredModels[runner] ?? [];
+      const capped = models.slice(0, CATALOG_MODEL_CAP);
+      const remainder = models.length - capped.length;
+      const ids = capped.map((m) => m.modelId).join(", ") || "(no models discovered)";
+      return `${runner}: ${ids}${remainder > 0 ? ` \u2026 +${remainder} more not shown` : ""}`;
+    });
+    const modeLines = this.plan.runners.map((runner) => {
+      const modes = runnerModes[runner] ?? [];
+      if (modes.length === 0) return `${runner}: (no modes declared)`;
+      const defaultId = resolveDefaultMode(modes, autonomousDefault);
+      const ids = modes.map((m) => `${m.id}${m.id === defaultId ? " (default)" : ""}`).join(", ");
+      return `${runner}: ${ids}`;
+    });
+    return [
+      "<available_models>",
+      ...modelLines,
+      "</available_models>",
+      "<available_task_modes>",
+      ...modeLines,
+      "</available_task_modes>"
+    ].join("\n");
+  }
   /**
    * The "you are here" block for post-plan chat: current tasks with stable
    * references, plus the task-ops protocol. Injected per turn (never
@@ -9828,44 +11590,48 @@ The plan is unchanged. Rephrase the request, or adjust the tasks manually.`,
   planContextBlock() {
     if (!this.plan || this.store.planTasks.length === 0) return null;
     const orderOf = new Map(this.store.planTasks.map((t) => [t.id, `#${t.order}`]));
-    const lines = this.store.planTasks.map(
-      (t) => `#${t.order} id=${t.id} "${t.title}" [${t.status}] runner:${t.assignedRunner}${t.assignedModel ? ` model:${t.assignedModel.modelId}` : ""} deps:[${t.dependencies.map((d) => orderOf.get(d) ?? d).join(", ")}]`
-    );
+    const lines = this.store.planTasks.map((t) => {
+      const isMan = t.type === "user";
+      const runFields = isMan ? `steps:${t.userSteps?.length ?? 0}` : `${t.assignedModel ? `model:${t.assignedModel.modelId} ` : ""}mode:${t.taskMode ?? "build"} effort:${t.thinkingEffort ?? "-"}`;
+      return `#${t.order} id=${t.id} "${t.title}" [${t.status}] type:${isMan ? "MAN" : "AI"} runner:${t.assignedRunner} ${runFields} autonomy:${t.autonomy ?? "-"} slice:${t.sliceType ?? "-"} deps:[${t.dependencies.map((d) => orderOf.get(d) ?? d).join(", ")}]`;
+    });
     const locked = this.store.planTasks.filter((t) => t.status === "in_progress");
     const execNote = this.hasLiveWork ? `
 Execution is RUNNING${locked.length ? ` \u2014 these tasks are locked: ${locked.map((t) => `#${t.order}`).join(", ")}` : ""}. Any task edits you emit will be queued and applied between batches.` : "";
-    const modelLines = [];
-    for (const runner of this.plan.runners) {
-      const models = this.modelsCache[runner] ?? [];
-      const ids = models.map((m) => m.modelId).join(", ");
-      modelLines.push(`${runner}: ${ids || "(no models discovered)"}`);
-    }
-    const modelBlock = modelLines.length > 0 ? ["<available_models>", ...modelLines, "</available_models>"].join("\n") : "";
+    const updateChanges = UPDATABLE_FIELDS.map((f) => f === "dependencies" ? '"dependencies"?:["<id or #order>"]' : `"${f}"?`).join(",");
     return [
       "<current_plan>",
       ...lines,
       "</current_plan>",
-      modelBlock,
-      "The block above is the CURRENT task plan. Choose how to respond:",
+      "The block above is the CURRENT task plan \u2014 short fields only. Choose how to respond:",
       "- To answer a question or discuss, reply in plain prose (no JSON).",
+      // The reminder text is owned by TaskQuery beside the parser, so the
+      // protocol the planner reads and the one Ordewell accepts stay one thing.
+      TASK_QUERY_REMINDER,
       "- To modify specific tasks, reply with ONLY this JSON object:",
       '  {"taskOps": [',
-      '    {"op":"update","taskId":"<id or #order>","changes":{"title"?,"description"?,"prompt"?,"dependencies"?:["<id or #order>"],"assignedRunner"?,"assignedModel"?,"taskMode"?}},',
-      '    {"op":"add","task":{"title","description","prompt","dependencies":["<id or #order>"],"assignedRunner"?,"assignedModel"?}},',
+      `    {"op":"update","taskId":"<id or #order>","changes":{${updateChanges}}},`,
+      '    {"op":"add","task":{"title","description","prompt","dependencies":["<id or #order>"],"assignedRunner"?,"assignedModel"?},"handle"?:"<name>"},',
       '    {"op":"remove","taskId":"<id or #order>"},',
-      '    {"op":"reorder","taskIds":["<id or #order>", "... every task exactly once"]},',
-      '    {"op":"merge","taskIds":["<id or #order>", "..."],"merged":{"title","description","prompt"?,"assignedRunner"?,"assignedModel"?,...}},',
-      '    {"op":"split","taskId":"<id or #order>","parts":[{"title","description","prompt"?,"assignedRunner"?,"assignedModel"?,...}, ...]}',
+      '    {"op":"reorder","taskIds":["<id or #order>", "... every task exactly once"]},   // only to re-prioritise INDEPENDENT tasks',
+      '    {"op":"merge","taskIds":["<id or #order>", "..."],"merged":{"title","description","prompt"?,"assignedRunner"?,"assignedModel"?,...},"handle"?:"<name>"},',
+      '    {"op":"split","taskId":"<id or #order>","parts":[{"title","description","prompt"?,"assignedRunner"?,"assignedModel"?,...}, ...],"handle"?:"<name>"},',
+      `    {"op":"rearm","taskId":"<id or #order>","changes"?:{${updateChanges}}}`,
       "  ]}",
       '- For sweeping changes, you may instead emit a full {"tasks":[...]} plan JSON.',
+      'Every "<id or #order>" ref in a batch resolves against the plan shown above, before any op in the batch runs \u2014 an earlier remove/merge/split never shifts what a later "#N" means.',
+      'Give "add", "merge", or "split" a "handle" (any name you choose, unused elsewhere in this batch) to let a LATER op in the same batch reference the task it produces \u2014 for "split", the handle names its last part. A handle used before its defining op is rejected.',
       'When creating or changing tasks, set "assignedRunner" and "assignedModel" ({"modelId","modelLabel","thinkingEffort"?}) using only the runners and models listed in <available_models>.',
-      "Keep dependencies consistent: no cycles, no references to removed tasks, dependencies must come before dependents, and never touch running or completed tasks." + execNote
+      'Keep dependencies consistent: no cycles, no references to removed tasks, and never touch running or completed tasks \u2014 "rearm" is the one exception, below.',
+      'Just declare the dependencies you want \u2014 display order is repaired for you afterwards, so a rewire or a newly added prerequisite never needs a "reorder" op. Only a task that is running or completed cannot be shifted, so an edit that would need one to move is rejected.' + execNote,
+      'Flipping "type" between "ai" and "user" is a content change, not just a label: an update to "user" needs "userSteps" in the SAME op, and an update to "ai" needs "prompt" in the SAME op \u2014 the model/mode/effort/autonomy fields (flipping to "user") or the userSteps (flipping to "ai") are cleared automatically.',
+      '"rearm" puts a failed OR completed task back to pending \u2014 verdict and output summary are cleared, any dependents it had blocked are released, and it may carry field changes (e.g. a corrected "prompt") applied in the same op. A running task cannot be re-armed. Never rearm a task just to relabel it \u2014 only when it should actually run again.'
     ].filter(Boolean).join("\n");
   }
   /** Validate + commit a task_ops turn atomically. Returns the errors on rejection (plan untouched). */
   applyTaskOpsTurn(turn) {
     if (!this.plan) throw new Error("No active plan state");
-    const result = applyTaskOps(this.store.planTasks, turn.ops, this.plan.runners);
+    const result = applyTaskOps(this.store.planTasks, turn.ops, this.plan.runners, this.editCatalog());
     if (!result.ok) return { errors: result.errors };
     const now = (/* @__PURE__ */ new Date()).toISOString();
     const content = `Tasks updated:
@@ -10132,15 +11898,22 @@ Execution is RUNNING${locked.length ? ` \u2014 these tasks are locked: ${locked.
     return plan;
   }
   /**
-   * Patch one task's fields. A hand-set dependency list is the one patch that
-   * can leave the plan unschedulable, so it goes through the same
-   * {@link canSetDependencies} guard the planner's pickers use rather than a
-   * second copy of the rule — and throws, so the surface can say why.
+   * Patch one task's fields. A hand-set dependency list, or a type flip
+   * between AI and MAN, are the patches that can leave a task incoherent
+   * (unschedulable, or carrying fields that mean nothing for its new type),
+   * so both go through the same {@link validateTaskEdit} guard the planner's
+   * task-ops applier uses (as the 'direct' actor, which skips the lock rule)
+   * rather than a second copy of the rules — and throws, so the surface can
+   * say why. Gated on the task existing so an edit to an unknown id still
+   * falls through to the no-op `store.update` below instead of throwing.
    */
   async updateTask(taskId, changes) {
-    if (changes.dependencies) {
-      const check = canSetDependencies(this.store.planTasks, taskId, changes.dependencies);
-      if (!check.ok) throw new PlanEditError(check.error ?? "Those dependencies are not valid");
+    if ((changes.dependencies || changes.type || changes.assignedModel || changes.taskMode) && this.store.get(taskId)) {
+      const check = validateTaskEdit("direct", this.store.planTasks, taskId, changes, this.editCatalog());
+      if (!check.ok) throw new PlanEditError(check.error ?? "Those changes are not valid");
+      if (check.clear?.length) {
+        changes = { ...changes, ...Object.fromEntries(check.clear.map((f) => [f, void 0])) };
+      }
     }
     return this.editPlan(
       () => Boolean(this.store.update(taskId, changes)),
@@ -10781,7 +12554,7 @@ import { execFile as execFile2 } from "child_process";
 import { promisify as promisify4 } from "util";
 import { tmpdir } from "os";
 import { join as join10 } from "path";
-import { existsSync as existsSync6, readFileSync as readFileSync4, unlinkSync as unlinkSync2, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync4, unlinkSync as unlinkSync2, writeFileSync as writeFileSync6 } from "fs";
 
 // src/utils/tmux.ts
 import { execSync as execSync2 } from "child_process";
@@ -10872,7 +12645,7 @@ var TmuxSession = class extends AbstractTerminalSession {
    * lets the user keep poking at a finished task's terminal.
    */
   async start(command, args, cwd, env) {
-    writeFileSync5(this.logPath, "");
+    writeFileSync6(this.logPath, "");
     const envAssignments = Object.entries(env ?? {}).map(([k, v]) => `${k}=${posixShellQuote(v)}`).join(" ");
     const inner = [command, ...args].map(posixShellQuote).join(" ");
     const prefix = envAssignments ? `env ${envAssignments} ` : "";
@@ -12175,6 +13948,11 @@ export {
   SettingsService,
   StdioAgentAdapter,
   TASK_OPS_ENVELOPE_KEY,
+  TASK_QUERY_ANSWER_OR_OPS,
+  TASK_QUERY_ENVELOPE_KEY,
+  TASK_QUERY_FIELDS,
+  TASK_QUERY_PROTOCOL,
+  TASK_QUERY_REMINDER,
   TRUNCATED_PLAN_REPAIR_INSTRUCTION,
   TaskOrchestrator,
   TmuxRunner,
@@ -12245,6 +14023,7 @@ export {
   emptyWarnings,
   enabledRunners,
   ensureDir,
+  ensureStateDirIgnored,
   escapeControlCharsInStrings,
   executionLogBlock,
   executionSummary,
@@ -12294,6 +14073,7 @@ export {
   parsePartialPlan,
   parsePlanJson,
   parseTaskOpsJson,
+  parseTaskQueryJson,
   pendingEditRulesBlock,
   planDirectLaunch,
   planShellLaunch,
@@ -12302,11 +14082,13 @@ export {
   providerForRunner,
   reEmitPlanPrompt,
   reEmitTaskOpsPrompt,
+  reEmitTaskQueryPrompt,
   readDaemonToken,
   referencePattern,
   removeTaskFromPlan,
   renderPlanMap,
   renderPriorOutputs,
+  renderTaskQueryAnswer,
   renumberTasks,
   repairLoop,
   researchShellWarning,
@@ -12340,7 +14122,9 @@ export {
   summarizeOutput,
   summarizeToolCall,
   taskOpsRejectedPrompt,
+  taskQuerySignature,
   textHasTaskOps,
+  textHasTaskQuery,
   tmuxSessionName,
   tmuxSocketName,
   tmuxWindowName,